topic Re: How to search for url fields that only contain IP address in Splunk Search

How to search for url fields that only contain IP address

mrtolu6 — Thu, 06 Jul 2017 16:36:31 GMT

I'm trying to do a search that will show me only IP address for the field url,

example = sourcetype=fakename url=(only field that has IP address in it 1.1.1.1 or 1.1.1.1/index)

Do you know what i can use for the url field that will only give me ip address?

Re: How to search for url fields that only contain IP address

somesoni2 — Thu, 06 Jul 2017 16:39:37 GMT

Try like this

index=foo sourcetype=bar | regex url=".+(\d{1,3}\.}{3}\d{1,3}).*"

Re: How to search for url fields that only contain IP address

DalJeanis — Thu, 06 Jul 2017 17:43:35 GMT

Note - This solution answers the question in the title - what will eliminate all records that do not have an IP somewhere in the url field. I'm not absolutely sure that's what the OP is asking, but I'm not sure it's not.

@mrtolu6 - If you only want url values that START with an IP, like your examples, then replace the .+ with ^

Re: How to search for url fields that only contain IP address

mrtolu6 — Thu, 06 Jul 2017 20:01:35 GMT

This, seems to run slow when i run this, do you know another search i can run to get the IP addressw

Re: How to search for url fields that only contain IP address

somesoni2 — Thu, 06 Jul 2017 21:30:28 GMT

Try these to see if they perform any better. Since you're filter is regex driven, it can't be easily include in base/main search which will make it faster.

not so much hope on being faster

index=foo sourcetype=bar | where match(url,"(\d{1,3}\.}{3}\d{1,3})")

OR dirty workaround

index=foo sourcetype=bar [| gentimes start=-1 | eval p=mvrange(1,10) | table p | mvexpand p | eval q=mvrange(0,10)  | mvexpand q | eval r=mvrange(0,10)  | mvexpand r | eval s=mvrange(0,10)  | mvexpand s | eval url="*".p."*.".q."*.".r."*.".s."*" | table url]

Re: How to search for url fields that only contain IP address

mrtolu6 — Mon, 10 Jul 2017 12:54:59 GMT

none of these seems to work.

Re: How to search for url fields that only contain IP address

automayt — Tue, 15 Sep 2020 20:49:57 GMT

This will output only things where the url looks like an ip address.

sourcetype=fakename | where match(url, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$")